How to tell agent traffic from user traffic
Blog post from WorkOS
Agent Auth, now in early access, aims to make automated actions visible in systems where agents often operate through shared accounts or borrowed user sessions, causing audit logs to incorrectly attribute software actions to people. Its agent access tokens are JWTs verified through existing user-token infrastructure but include a `sub_profile` claim set to `ai_agent`, allowing applications to distinguish agents from users reliably without maintaining identifier lists. Agent tokens separate the acting agent instance in `sub` from the delegating user in `act.sub`, enabling audit trails to record both the actor and the authority, while autonomous agent sessions have no delegated user. The recommended approach is to preserve agent-related details such as caller type, authorizing user, session, and declared intent in audit-log metadata; intent is useful context but is not verified evidence of an action’s purpose. Lifecycle webhooks and Events API events for agent blueprints, instances, and sessions provide visibility into agent creation, configuration, use, and revocation, while separating agent traffic from user traffic enables monitoring of automated write activity, permission denials, session behavior, and actions tied to inactive delegating users.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.